An ABAC policy defines access control permissions based on the attributes of the subject, of the resource, and of the action that the subject wants to perform on the resource (e.g., read, write). A resource may be, inter alia, a portion of a personal storage quota, a business unit storage quota, an information retrieval system, a (portion of a) database, an online service, a protected webpage or a physical device.
There currently exist general-purpose AC languages that have the richness to express fine-grained conditions and conditions which depend on external data. One particular example of an AC language is the eXtensible Access Control Markup Language (XACML) which is the subject of standardization work in a Technical Committee of the Organization for the Advancement of Structured Information Standards (see http://www.oasis-open.org). A policy encoded with XACML consists of functional expressions in attribute values, and the return value (decision) of the policy is one of Permit, Deny, Not Applicable, or Indeterminate. An XACML policy can apply to many different situations, that is, different subjects, resources, actions and environments and may give different results for them. The XACML specification defines how such a request is evaluated against the policy, particularly what policy attributes are to be evaluated or, at least, which values are required to exist for a successful evaluation to result. Key characteristics of this evaluation process are that the request (the query against the policy) must describe the attempted access to a protected resource fully. In practice, it may be that the request is constructed in multiple stages by different components, so that a PEP (Policy Enforcement Point) provides only some initial attribute values and a PDP (Policy Decision Point) or other components can dynamically fetch more values from remote sources as they are needed.
XACML-based solutions typically introduce “authorization as a service” whereby a Policy Enforcement Point (PEP) within a target application/system captures access requests in real time and sends them to a Policy Decision Point (PDP) for evaluation against one or more XACML policies. In practice, however, many organizations operate systems for which there are currently no PEP components available, and whose authorization mechanisms are built around other models than XACML.
One example of such non-XACML models, is Security Descriptor Definition Language, SDDL, of Microsoft Corp. of Redmond, Wash., which provides a syntax for defining access conditions in a string format. The syntax is e.g. used in Active Directory (AD) which is a directory service for Windows domain networks available from Microsoft Corp. of Redmond, Wash.